d4869d7d075e00ffd29a91f6272cac42172c6e9f3857381e9c0a718c01654ae1

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0de3a9ea4ba1098525fdd324c5595b8d_JaffaCakes118.html
Size

158KB
MD5

0de3a9ea4ba1098525fdd324c5595b8d
SHA1

34812f12cb8a2c86baf0cda69e676a974ae10cd6
SHA256

d4869d7d075e00ffd29a91f6272cac42172c6e9f3857381e9c0a718c01654ae1
SHA512

3f7bb7e5964d2eb95e1b5cc14b437f46a9f4e76864ed6b2631f7141081266db45bbd755eef4078107cdabcf463e0cfa7c44d94921cf5d67915f60f18b6814806
SSDEEP

3072:9JHWohEUikwmqldBF5shq1tI5Vy9c/86nzqLkz+WH3B+ePtEsWD:9JHWSW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
1516	msedge.exe
1516	msedge.exe
944	identity_helper.exe
944	identity_helper.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2440	1516	msedge.exe	85
PID 1516 wrote to memory of 2440	1516	msedge.exe	85
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1936	1516	msedge.exe	86
PID 1516 wrote to memory of 1992	1516	msedge.exe	87
PID 1516 wrote to memory of 1992	1516	msedge.exe	87
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88
PID 1516 wrote to memory of 3840	1516	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0de3a9ea4ba1098525fdd324c5595b8d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7bd746f8,0x7fff7bd74708,0x7fff7bd74718
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,18230773084877550472,12566686626378823149,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
3c8aa0fad1509cf04f63594406f179e8

SHA1
c6e74ed5c65fa7814dd21b7d1747266f9b1815da

SHA256
99e3ba4f957b2c998124d58abcc5e6272e2f7b8b44c34bfb8da58be5d758067d

SHA512
f2f8c27a6ab7514d0a41ede2ea8d0114a6dd51fcb9923d866683186684ed900f5cbd3f5323ee2b213ad8964272dd04ddaf400a2e3069afa9342977052e0ff5df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
46e655c57400079f5bf1ed90d5846411

SHA1
d0a31147a22d215d85fd773bd9084aeada943712

SHA256
199177a7df3bf9ed5c5444eb00055ba2a31624e281c341cf2cd91a853d4d5ab8

SHA512
182f67392be901b4c6bbd57fbe142c68d028d898674788d18cbbb5e85e7b1cb9ea67e50828ddf3f21fabf65c6a5f31f9640b3a66e9e4d5a76d758577d0df8937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d53717f177dcc432d36c9e136a18b7c9

SHA1
a32726e68ad018bb60b10b0d60c4133e4125b92f

SHA256
cfcafccbb06b09c1e110313b81527df69610e922e3636f92ea3f687894889914

SHA512
8fda83310093b0f03f59bfe5c8636072e1b08ac0ae5f5e7274ab0dc815b8896d573eed8cdd1cd3e993ef105eec9cd8408d39373f5656de89635f05a2886cee54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6fb243ad9ed1b645a42346da033cec68

SHA1
4426884e7ed23ec973bd2542599b2f5659d00938

SHA256
4856f88c4db53e748bb7fa03204a718664a9e14007f2c65a8a59b42c783bbc52

SHA512
c99f006081d50ad6f7983bd14ecf6f1bc1f2a1c052501b469e8e742cadad3b00ac22440fcd87e8d8b5c9368e877bf3fad837607bc3947f499acfa038a5017fd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e9bee88fca62ec0cf283e6de1252df81

SHA1
52fa3b2b7be9b98f68d4c08b05f873693957c80a

SHA256
42faf4abccf5f22445a285be373f7c4e89f7c6811c9f3679236f82b5a2c72418

SHA512
9cedceb9d9e563bd28bca134e454e95c942cef811999f0f85ab7178812fc9f899de9c5e0610b42eb51f1992fcddc0f318eba22683c86bfa53dba8bc4cb9a6c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dd6bf70b3761288906b2df56b59ebfaa

SHA1
b999e71e49b31f06d74d38044f1a0a14c55da029

SHA256
abd762a9e0cbfaebf6f5a8869c9e763b0f1943bfa700e75b19a3feb5067d68a4

SHA512
1978ebbb0e787cc9906783ba31a3ddf51371eb1cb44f56500180975a903122cacbeb88593c3e96a95dab8730e42d1e9127f0e6c06bac12249cd64894b000f1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7c2be436384c8212167818c8347acdee

SHA1
9929eda198483bbdd7e5615c868de4488861624f

SHA256
c3f40e64c008003e8e022fade390e619ae5082355deae8f7446bf9750be10dfd

SHA512
0b4d20d655856a1d5d0ea75f846f61faaad7453dcb0dfd353943f74ac52a4e65cd6df061159912250678bc9d1b28b85ec069d3cdb109eb43f3a0a68ebba6bd8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bf85c8322d34ff3aa9fbc84ce00ef34d

SHA1
ffdfb5ead7370b09b6d2509418a6e5c4d9d98722

SHA256
d4fa41aece77c481b2614181907afa88312a7720762641c7acbbbe70bf0e42c2

SHA512
170402805840e34f6950f24b5e1dc207f20bbe6e42d84cd5141283d7dec53810a0a4859212aad6c4923ab99f8172ae2229c48720fa344d491a13c763e6dd062a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
3488b05d04878e9c832c169328865577

SHA1
ae03a4955d695e772e6008ec129a0685a38c9ea7

SHA256
d62650854178a4381c856930059950d375b15994c0ac4d2143ab4bc77566b1c9

SHA512
25cdc0512589ea373b64ddc08b641ad2f09cf107edd005f6644e8ac1fad445fae537e6e518f89c5c39c99fb7be1406c41a699a43d03c73da7694bf81cfcb49d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
28120d3087c13351b8291cfef5a4541d

SHA1
3520db1693dbae74dbb8e869a9287e3ae1d8cdc1

SHA256
9dc014527919448519042686012a9486b59010b3505ca1db3597c9b28d6cb7ae

SHA512
f791888394f7d81520242c5c54aeb98596a5273259eb32e8e59a7a2bdfdd6faf75f53e0256681b0c6def94ac4855e36a7888c5f19b0f81154554de82c8d1dad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579470.TMP

Filesize
203B

MD5
c72b28207f9c6d47b91784552d076c13

SHA1
af446a91b723d5c9bdedec6c10a5bde8a0ae04ce

SHA256
a76260d94808743099ca382e6e33900d8100e7c41e1281d3b85abba9bea104ac

SHA512
af53ba811bd755a3dfd807ac60ca47cc2009a436d045db150ba7033c83d290f4a4ca2270c6f1a3647ef2feb42307f7397477f870b85a4ffd12b1bb19f41ccd36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1bd052535cc68c440426d3b0edadbdbc

SHA1
451ddad5c66ea3cf55b0a33a090fdfad248c5ebc

SHA256
d6467c8e1d03fd3f6fe0d255fdaf1ca4be88739614cff2a34aa380950a89f59e

SHA512
bd2a4d432e13147de41a70c6209f5df466837e8abf8ce90b8d56d711081d65308f9cd6438de8d645ed678d097ea9009762e9eed4cd4ca1ccc324d19ece5f0e1d

Download Submit